procmail
[Top] [All Lists]

Re: Stripping bad attachments

2005-01-21 13:25:57
On Fri, Jan 21, 2005 at 09:55:41AM -0600, Pettit, Paul wrote:

From: Dallman Ross

On Thu, Jan 20, 2005 at 07:20:45PM -0600, Pettit, Paul wrote:

Google Kreme

On Thu, 20 Jan 2005 17:33:51 -0600, Pettit, Paul 
<ismanager(_at_)ccbnpts(_dot_)com> wrote:

    :0 HB

Don';t use H


Is that because procmail parses the Header by default or is 
that just a personal preference?


1) Because it's the default; 2) because there is a known procmail
bug that if you turn it on there you can never subsequently turn it
off.  See, e.g., Nancy McGough's QuickStart pages, which highlight
the old discussion about that point.


I read about that bug but I didn't feel it was relavent, plus I wasn't
sure the bug was still "alive" being that it was from 2+ years ago. I'll
remove it and see if the recipe functions the same.

Okay.  If you just remove the H and leave the B, though, of course
the header won't get searched.  You can use the alternate syntax
to do the same thing:

   :0
   * HB ?? regex

In the comment on the 'Hhb' default however it seems to imply that if
you do use flags in a recipe, the defaults will not be implied. Thus if
I were to do a ':0 B' then the headers would not be checked (i.e. the
'B' overrides the defaults). Is this correct or no?

Correct.  But the above will be fine.

complete recipe:

#####
:0
*^Content-type: (multipart/mixed|application/octet-stream)
{
    :0 HB
    *^Content-Disposition: (attachment|inline);
 
*filename=".*\.(vbs|wsf|shs|exe|chm|pif|vbe|hta|bat|cmd|com|hlp|jse|pcd|
reg|scr|lnk|url|cpl)"
    {
       SHELL=/bin/sh

Better form is to set the shell near the top of the rcfile and be
done with it.  That way, if you add more pipes later, you won't
have to keep thinking about this.


       :0 f
       |/usr/bin/demime -

We usually stick the w or W flag in with the f flag as a matter of course.
Without it, if there is a failure of demime, your original message might
well not be recovered.


       :0 fhbw
       |/bin/sed \
- -e 's/^Subject:/Subject: **ATTACHMENT REMOVED**/'


Again, why are you sending the messaeg body to the pipe?  We only
need the header.

       :0 c
       /tmp/virus

If that's an mbox-style folder, you need a lockfile colon after the c.

I'll look into formail more but please review the "complete" recipe and
let me know if it changes your feedback.

Not as to formail, no.

Dallman

____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>